Crypto Licensing in Morocco: 2026 Guide to the Forthcoming Law, Bank Al‑maghrib Position and Market Entry

Introduction, Quick summary and what this guide covers

The landscape for crypto licensing Morocco is changing rapidly, and businesses considering entry into the Kingdom’s virtual-asset market need definitive, practitioner-level guidance rather than headlines. As at the last review date of this guide, Morocco is transitioning from a restrictive stance adopted in 2017 toward a comprehensive regulated framework being prepared under the authority of the Ministry of Economy and Finance, with Bank Al‑Maghrib expected to play a central supervisory role. This guide explains where the law stands, who will supervise the sector, the likely licensing process, stablecoin-specific considerations, and a practical, risk-focused checklist for firms seeking to operate compliantly.

Throughout this guide we distinguish clearly between what is final and what remains draft. Where the forthcoming legislation is silent or ambiguous, we flag the uncertainty and recommend engaging local counsel rather than assuming requirements. Our aim is to give exchanges, custodians, stablecoin issuers, payment-service providers and their advisers a reliable foundation for strategic planning around crypto licensing Morocco while the legal framework is being finalised.

Snapshot: legal status in one minute

As at the last reviewed date, cryptocurrency in Morocco sits between a 2017 restriction and a forthcoming regulated regime. A draft crypto law is under review at the Ministry of Economy and Finance, and Bank Al‑Maghrib has signalled a supervisory, enforcement-first posture. Until the law is enacted and published in the Official Gazette, firms should treat the regime as transitional and engage regulators early.

Who should read this guide

This guide is written for crypto exchanges, custodians, stablecoin issuers, wallet providers, payment-service integrators, institutional investors and the legal and compliance advisers supporting them. It is equally valuable for international groups assessing market entry Morocco crypto strategies and for domestic founders preparing for regulated operations.

Legal status and background

Understanding the current position on crypto licensing Morocco requires appreciating how the regulatory posture has evolved over nearly a decade. The Moroccan authorities moved from an outright warning against virtual currencies to the active preparation of a licensing framework, a shift that reflects both global regulatory maturation and domestic market activity that never fully ceased.

2017 ban and market evolution, what changed

In November 2017, the Moroccan authorities, including Bank Al‑Maghrib working alongside the Autorité Marocaine du Marché des Capitaux and the foreign-exchange office, issued public warnings that transactions in virtual currencies constituted a breach of exchange regulations and were subject to penalties. The message to the market was clear: crypto activity carried legal exposure under existing foreign-exchange and financial law.

Despite that restriction, peer-to-peer trading, remittance use and investor interest persisted and, by several accounts, grew. The gap between formal prohibition and practical market activity created precisely the kind of regulatory uncertainty that undermines consumer protection and anti-money-laundering objectives. Over subsequent years, official commentary shifted from pure prohibition toward the recognition that a regulated framework would better serve financial-stability and supervisory goals. That evolution set the stage for the current legislative effort and the modern debate around crypto licensing Morocco.

The 2025–2026 draft law, scope and objectives

A draft crypto law has been prepared and is under review at the Ministry of Economy and Finance. Based on official communications from the Ministry of Economy and Finance and statements attributed to Bank Al‑Maghrib leadership, the draft aims to establish a licensing and supervisory regime for virtual-asset service providers, to align Morocco with international standards, and to bring stablecoins and exchange authorisation within an explicit regulatory perimeter.

While the precise text remains subject to change until enacted, the framework is expected to address the following areas:

• Assets covered: crypto-assets and virtual assets used for exchange, investment or payment are expected to fall within scope, consistent with international definitions.
• Regulated activities: operation of exchanges, custody and safekeeping services, and issuance of tokens, including stablecoins, are anticipated to require authorisation.
• Stablecoins singled out: stablecoins and exchange authorisation have been highlighted as early regulatory priorities, implying dedicated reserve, redemption and disclosure obligations.
• Excluded or restricted activities: purely private self-custody and non-commercial use may fall outside the core licensing perimeter, though this remains subject to the final text.
• Consumer protection and AML alignment: the draft is expected to embed anti-money-laundering, investor-protection and financial-stability safeguards consistent with FATF expectations.

Because the morocco crypto law remains in draft, firms should treat any specific numeric or procedural requirement as provisional until the statute is published in the Bulletin Officiel. Where this guide references capital, reserves or timelines, we use cautious language and flag the dependency on final text.

Anticipated timeline to enactment and transitional provisions

As at the last reviewed date, the draft is at the Ministry of Economy and Finance for review and inter-institutional coordination. Legislative processes in Morocco typically involve review by the relevant ministries, adoption by the Council of Government and the Council of Ministers, parliamentary passage and finally publication in the Official Gazette, which fixes entry into force. Each stage can take months, and the sequence introduces genuine timing uncertainty.

Industry observers expect the framework to advance through 2026, but no firm commencement date should be assumed until the law is promulgated. Firms planning around crypto licensing Morocco should therefore build flexibility into launch plans and anticipate transitional provisions, common in comparable regimes, that give existing operators a defined window to seek authorisation or wind down non-compliant activity. We recommend monitoring Ministry and Bank Al‑Maghrib communications directly for the definitive timeline.

Regulatory landscape and who will supervise

Effective planning for virtual asset regulation Morocco depends on knowing which authorities hold which powers. The anticipated framework is likely to distribute responsibilities across the central bank, the capital-markets regulator and the financial-intelligence unit, with coordination mechanisms to avoid overlap.

Bank Al‑Maghrib: mandate, public statements and likely supervisory tools

Bank Al‑Maghrib, the central bank, has consistently positioned itself at the centre of the emerging regime. Its public statements emphasise financial stability, consumer protection and the risks posed by unregulated virtual-asset activity, and its leadership has confirmed that a regulatory framework is in preparation. The posture to date has been best described as enforcement-first: while the law is finalised, existing restrictions remain enforceable, and firms should not assume that the absence of a bespoke licensing law equals a permissive environment.

Under the forthcoming framework, bank al-maghrib crypto supervision is expected to include authorisation and licensing of service providers, ongoing prudential oversight, powers to impose conditions on authorised entities, on-site inspection rights, and sanctioning powers for breaches. Firms exploring crypto licensing Morocco should treat Bank Al‑Maghrib as the primary gatekeeper and prioritise early, constructive engagement with the central bank’s relevant departments.

AMMC (capital markets authority) and other regulators, roles and coordination

The Autorité Marocaine du Marché des Capitaux (AMMC) supervises Morocco’s capital markets and is a natural co-regulator where crypto-assets display the characteristics of securities or investment products. Tokens offered to the public as investments, tokenised instruments and certain exchange functions may fall within or alongside AMMC’s remit. The AMMC was a co-signatory to the original 2017 warning, underscoring its interest in the sector.

The precise allocation of responsibility between Bank Al‑Maghrib and the AMMC will depend on how the final law classifies different crypto-assets and activities. Firms should expect coordinated supervision and, in some cases, dual touchpoints, particularly where a business model spans payments, exchange and investment features. Mapping your product features against likely regulatory classifications is a critical early step.

CENTIF / AML supervision and criminal risks

Anti-money-laundering supervision is expected to involve the Cellule Nationale de Traitement du Renseignement Financier (CENTIF), Morocco’s financial-intelligence unit. Virtual-asset service providers will almost certainly be designated as reporting entities, subject to customer due diligence, suspicious-transaction reporting and record-keeping obligations consistent with the FATF standards on virtual assets and VASPs. Non-compliance with AML and exchange-control rules can carry criminal exposure under existing law, which reinforces the importance of robust compliance even before the dedicated regime is enacted.

Process, How to obtain a crypto licence in Morocco

The following numbered process describes the practical route to a crypto license Morocco applicants should expect, tailored to exchanges, custodians, stablecoin issuers and payment-service providers. Because the law is in draft, treat specific thresholds as provisional and confirm against the final statute. The sequence below reflects comparable VASP licensing regimes and the signalled direction of Moroccan policy.

1. Pre-application regulatory assessment and classification of your business model. Begin by mapping each function, spot exchange, custodial safekeeping, stablecoin issuance, wallet provision, or payment integration, against the activities the draft law regulates. Classification determines which licence category and which regulator applies. A centralised exchange with custody, for example, will face different obligations than a pure non-custodial interface. Document your token taxonomy and transaction flows, because this analysis drives every subsequent requirement and shapes your engagement strategy with regulators.
2. Engagement with Bank Al‑Maghrib and the AMMC for pre-filing guidance. Given the enforcement-first posture, early engagement is a risk-mitigation tool, not merely a courtesy. Request pre-filing meetings or written guidance to confirm how your model will be classified, which authority leads, and what documentation the supervisor expects. Constructive dialogue reduces the likelihood of surprises during review and signals good faith, a meaningful factor while the regime is transitional and discretion is wide.
3. Corporate and local presence requirements. Most comparable regimes require a locally incorporated entity or, at minimum, a licensed local presence with accountable senior management physically present. Expect the Moroccan framework to require either a local subsidiary or a branch with an authorised representative, together with evidence of substance, offices, staff and governance located in-country. Confirm foreign-ownership rules and exchange-control implications early, as these affect capital flows and shareholder structuring.
4. Documentation package. Assemble a comprehensive application dossier: a detailed business plan with financial projections; your AML/KYC programme and transaction-monitoring design; technology and security architecture; custody and safeguarding arrangements; internal policies covering risk, conflicts and complaints; and governance documentation. The quality and completeness of this package strongly influences review timelines. Draft every policy to be operational, not aspirational, because supervisors increasingly test whether controls are implemented in practice.
5. Fit-and-proper checks for directors and control persons. Expect the regulator to assess the competence, integrity and financial soundness of directors, senior managers and significant shareholders. Prepare detailed CVs, criminal-record and regulatory-history disclosures, references and evidence of relevant experience. Any adverse history among beneficial owners or controllers can delay or defeat an application, so conduct internal due diligence on your own principals before filing.
6. Capital, reserve and financial requirements. Licensing regimes typically impose minimum capital calibrated to activity and risk, with higher thresholds for custody and issuance. For stablecoin issuers, expect reserve-backing, segregation and redemption obligations consistent with the morocco stablecoin framework being developed. Specific figures remain TBD, subject to the final draft, so plan conservatively and maintain capital headroom above any provisional threshold you model.
7. IT, security, custody and proof of safeguards. Supervisors will scrutinise how client assets and data are protected. Prepare evidence of robust key management, segregation of client assets, business-continuity and disaster-recovery plans, penetration-testing results and, where available, independent audits such as SOC 2 reports. Demonstrable safeguarding of custodied assets is often the decisive factor for custodian and exchange applications.
8. Application submission, review, queries and likely timelines. Submit the completed dossier and respond promptly to regulator queries. Statutory review periods, once fixed by the final law, may differ from practical timelines, which depend on application quality and regulator workload. Industry observers expect initial authorisations to take several months from a complete filing; applicants should budget time for iterative information requests.
9. Post-authorisation obligations. Authorisation is the beginning, not the end. Expect ongoing reporting to Bank Al‑Maghrib and, where relevant, the AMMC; periodic and event-driven disclosures; on-site inspections; consumer-protection compliance; and prompt notification of material changes to your business or controllers. Build an internal compliance calendar so recurring obligations are never missed.
10. Enforcement risks and how to mitigate during the pre-law enforcement-first period. Until the dedicated law is in force, existing foreign-exchange and financial-crime rules continue to apply, and enforcement remains possible. Mitigate by suspending or geofencing high-risk retail services, documenting legal analysis of each activity, engaging regulators proactively, and preparing a remediation plan. Treat the interim period as the highest-risk window for crypto licensing Morocco planning.

Comparison table, regulatory requirements, likely costs and timelines

The table below compares Morocco’s anticipated regime against two mature comparator frameworks to help firms benchmark expectations. Moroccan figures are provisional and marked TBD where the draft is not prescriptive; they should be confirmed against the final statute. Comparators illustrate the direction of travel rather than a prediction of identical outcomes.

Table: Morocco (draft law) vs selected comparator regimes

Readers who want a deeper benchmarking exercise can consult a dedicated global comparison of crypto licensing regimes as part of this cluster. The key takeaway is that Morocco appears to be converging toward internationally recognised standards, which favours firms that build compliance to FATF-aligned benchmarks from the outset.

Key requirements and eligibility

This section summarises the eligibility and substantive requirements firms should prepare for. Each element should be read as provisional pending the final text, but the categories reflect consistent features of comparable VASP regimes and the signalled priorities for crypto licensing Morocco.

Eligible entities and activities

The regime is expected to cover the core virtual-asset activities:

• Exchanges and trading platforms: matching, order execution and fiat on/off-ramps, likely the central focus of early authorisation.
• Custody and safekeeping: holding client crypto-assets, with heightened safeguarding and segregation duties.
• Stablecoin issuance: issuing fiat-referenced or asset-referenced tokens, subject to reserve and redemption rules.
• Wallet provision: custodial wallet services bringing providers within scope; self-custody tools may fall outside the core perimeter, subject to final text.
• Payment-service integrations: where crypto is used in payment rails, overlapping payments regulation may apply.

Fit-and-proper, governance and ownership rules

Expect requirements that directors, senior managers and significant shareholders demonstrate integrity, competence and financial soundness, supported by documentary evidence and background checks. Clear governance structures, defined accountability for compliance and risk, and transparency of beneficial ownership are likely to be prerequisites.

Capital, prudential and reserve requirements

Minimum capital calibrated to activity and risk is anticipated, with the highest expectations for custodians and issuers. Stablecoin issuers should prepare for full reserve-backing, asset segregation and redemption guarantees. Precise thresholds remain TBD, subject to the final draft, so model conservatively and maintain prudent capital buffers.

AML/KYC, sanctions screening, transaction monitoring expectations

Robust crypto compliance Morocco will demand risk-based customer due diligence, ongoing monitoring, sanctions screening, implementation of the FATF Travel Rule for qualifying transfers, and suspicious-transaction reporting to CENTIF. Build these controls as operational systems with audit trails, not merely documented policies, because supervisors test effectiveness in practice.

Compliance obligations: AML, reporting, consumer protection, cybersecurity

Beyond obtaining a licence, authorised firms must sustain comprehensive ongoing compliance. The obligations below reflect international standards and the expected shape of virtual asset regulation Morocco.

AML/KYC checklist tailored to Morocco

Drawing on CENTIF’s role as the financial-intelligence unit and FATF guidance, a practical AML/KYC programme should include:

• Customer identification and verification: risk-based onboarding with identity verification and ongoing refresh cycles.
• Beneficial-ownership checks: identifying and verifying ultimate owners for corporate customers.
• Risk rating and enhanced due diligence: tiered scrutiny for higher-risk customers, including politically exposed persons.
• Transaction monitoring: automated detection of anomalous patterns and thresholds.
• Travel Rule compliance: capturing and transmitting originator and beneficiary data for qualifying transfers.
• Suspicious-transaction reporting: timely filing to CENTIF with supporting documentation.
• Record retention: maintaining customer and transaction records for the statutory period.

Incident reporting, consumer disclosures and advertising restrictions

Authorised firms should expect obligations to report material incidents, including security breaches, to the supervisor promptly, to provide clear risk disclosures to customers, and to comply with restrictions on marketing and advertising designed to protect retail investors. Advertising of high-risk crypto products to consumers is a common focus of supervisory attention, and misleading promotion can attract sanction.

Data localisation, record retention and cybersecurity audit expectations

Firms should prepare for record-retention mandates, data-protection compliance under Morocco’s personal-data framework, and potential expectations around local data handling. Cybersecurity obligations are likely to include documented security governance, regular penetration testing, independent audits where appropriate, and demonstrable business-continuity and incident-response capabilities. Building these into operations early reduces the risk of remediation demands post-authorisation and strengthens any application for crypto licensing Morocco.

Market entry and commercial structuring

Commercial structuring choices materially affect regulatory exposure, tax position and operational resilience. The right structure for market entry Morocco crypto strategies depends on your activities, ownership and appetite for local substance.

Options: local subsidiary vs branch vs distribution partner

A locally incorporated subsidiary offers the clearest path to full authorisation and local substance, usually expected for licensed custody or exchange activity. A branch may suit groups that prefer to operate through an existing entity, subject to local-presence and accountable-management requirements. A distribution or partnership arrangement with an already-licensed local operator can accelerate access but shifts regulatory responsibility and demands rigorous partner due diligence. Each option carries distinct licensing, liability and exchange-control implications that should be modelled before committing.

Working with local banks, PSPs and correspondent relationships

Access to banking and payment rails is frequently the practical bottleneck for crypto businesses. Given the enforcement-first environment, Moroccan banks and payment-service providers may be cautious until the law is settled. Early relationship-building, transparent AML controls and evidence of a credible authorisation pathway improve the prospects of securing stable banking and correspondent relationships.

Tax and corporate structuring notes

Corporate tax, VAT treatment of crypto services, and cross-border considerations should be assessed alongside licensing. Tax outcomes can differ markedly between exchange, custody and issuance models, so integrate tax and corporate structuring advice into your market-entry plan from the outset rather than treating it as an afterthought.

Practical next steps and risk-mitigation checklist

The following actionable steps help firms manage risk while the regime is finalised and position for a successful application once crypto licensing Morocco becomes available:

• Conduct a pre-filing legal audit: classify every activity against the draft law and existing exchange-control and financial-crime rules.
• Appoint experienced local counsel: secure advisers who can engage regulators and interpret evolving requirements.
• Notify and engage regulators early: seek pre-filing guidance from Bank Al‑Maghrib and, where relevant, the AMMC.
• Freeze or geofence high-risk services: suspend activities carrying material enforcement exposure until authorisation is secured.
• Build an operational AML/KYC programme: implement controls aligned to CENTIF expectations and FATF standards.
• Prepare a compliance remediation plan: document gaps, owners and deadlines so the business is application-ready when the law is enacted.
• Strengthen custody and cybersecurity: commission independent audits and evidence safeguarding of client assets.
• Monitor the legislative timeline: track Ministry and Bank Al‑Maghrib communications for the definitive commencement date.

Sources

• Bank Al‑Maghrib, official statements and press releases on virtual-asset regulation and the central bank’s supervisory position: bkam.ma
• Ministry of Economy and Finance, Kingdom of Morocco, communications on the draft crypto law, its scope and timeline: finances.gov.ma
• Autorité Marocaine du Marché des Capitaux (AMMC), guidance and notices on virtual assets and capital-markets coordination: ammc.ma
• FATF, Guidance on Virtual Assets and Virtual Asset Service Providers, as the international standard for AML/CFT and the Travel Rule: fatf-gafi.org

Image alt text: Moroccan flag and digital currency icons over Casablanca skyline, crypto licensing Morocco regulation concept.